Accessing Dataedo Portal
Find out what options you have for accessing Dataedo Portal, how they differ, and how to configure them.
If you are not using the Active Directory login method, you should disable it in settings to ensure security. The default environment is often already available, which can grant everyone with an AD account access to Dataedo Portal. If you are using Active Directory, you may want to remove or limit the permissions assigned to default groups.
Login options in Dataedo Portal
Allowed login methods can be set and edited by Admin users.
To manage allowed login methods, navigate to Settings > System Settings and switch to the Login options tab. Your enabled login methods appear as tiles. You can add a new method using the empty Add new login method tile [a]. This opens a menu where you can configure your chosen login method (for specific instructions, visit the authentication section). Unsaved changes are marked as a draft [b] until you save your configuration.
If any factors might prevent a specific method from working, Portal displays a warning sign [a]. You can also use the Set as default [b] button to make a selected method the default for logging into Dataedo Portal.
This saved configuration takes precedence over other access settings. For example, even if you have configured a SAML provider but have not enabled SSO as a login option in System Settings, you will not be able to use it.
Your login options configuration also affects how the login form looks.
Automatically redirect to SSO
You can configure the login methods so that the relevant SSO service opens automatically when you access Portal's login page. For this option to work, you must meet two prerequisites:
- only one identity provider is configured for SAML
- no other login methods are enabled
To enable this option, check the Automatically redirect to SSO if it's the only available option checkbox in the SSO Service(SAML) section of the Login options tab.
The SSO redirection checkbox is not visible until you meet the prerequisites. Likewise, if you configure this option and then enable other login methods or identity providers, it will no longer work.
Login method binding
Every user account is bound to a single login method. This helps to maintain uniformity and safeguard your repository. A user can sign in only using their bound method (in the case of SAML login methods, each separate identity provider is counted as a different method). A sign-in attempt with any other method is rejected.
How binding works
There are multiple ways in which an account can be bound to an Identity Provider:
- First sign-in — a user whose login method is Not specified is bound to the method they first sign in with successfully.
- Accounts created by SAML — users created automatically on their first SAML login are bound to that SAML provider.
- Accounts imported by AD Kit — new users are bound to Active Directory.
- Accounts added manually — when adding a new user you can pick their bound login method in the Add User window. If you leave it as Not specified, the user's first sign-in sets it.
- The first user of a new repository — bound to a login method automatically when the repository is created.
Changing a user's login method
Bound login method can be changed only by an administrator. If you are a regular user in need of a change, contact your organization's admin
There are three ways for an Admin to change the user's bound login method.
User Profile
Navigate to Settings > User Management > Active Users, and open the user's profile.
In Settings (the first tab in the user profile, opened by default) you will see the Login method field. There you can edit the user's bound login method. Choose Not specified (assigned on first login) to clear the binding.
Login method
Go to Settings > System Settings > Login options, use the three dots icon on a login method's tile and select Users.
This opens a popup with the list of users in your repository, with their bound login method displayed as grey text next to their username. Users who are bound to this login method are highlighted. You can highlight users with a checkbox. Checking a user who already has another login method replaces their bound login method.
If you remove a user's checkmark, their login method is reset to Not specified, and they get a method again on their next sign-in.
Repository
Your organization's IT administrator can change the bound login method directly in the Dataedo repository. This method should be used only if the Portal Administrator is unable to log in, or is not presented and a change of a bound login method is urgent.
Every change of a user's login method, is written to the application log and the Windows Event Log, together with the previous and new method and the admin who made the change.
Interactions between bound methods and status of login methods
Changing a login method's status affects the users bound to it:
| What you do | What happens to bound users |
|---|---|
| Set a login method or SAML provider to draft | They stay bound, but cannot sign in until the method is active again. They are marked with a Draft label in the Active Users table. |
| Activate a draft login method | They can sign in again. No bindings change. |
| Disable a login method in Login options | They are reset to Not specified and get bound again on their next successful sign-in with any enabled method. Disabling SAML resets the users of every SAML provider. |
| Delete a SAML provider | Its users are reset to Not specified. Users of other SAML providers are not affected. |
| Edit or rename a SAML provider | Nothing changes. Users are bound to the provider, not to its name or settings. |
While a login method is in draft, its Users list only lets you unassign users. To prepare users for a draft SAML provider in advance, assign it in their user profile, where it is marked with (draft).
If a user is bound to a method that's in a draft state, you will see a draft badge next to their name in the User List. This helps you identify issues at sight.
To a person signing in, draft and disabled methods look the same, but they affect accounts differently. Draft keeps users bound, so they stay locked out. Disabling a method releases them to Not specified.
Authentication flow
The authentication flow differs between methods. After initial authentication, the authorization step uses Permissions in Dataedo Portal to apply each user's permissions accurately.
Please note that, for SQL Server, checking whether the login is in the Users Group actually means checking whether the login belongs to a user in that group (for SQL Server, a login and a user are not always the same).
Account creation flow
When a user completes authentication and the initial authorization flow but has no account in dbo.licenses (they are logging in for the first time and had no explicit permissions assigned before), a row is added and the user is granted access to Dataedo Portal based on default groups.
Please ensure that the default groups are set properly, as they are assigned to every new user authorized through any enabled login option. For instance, if a newcomer has an AD account and the AD login option is enabled, they will be granted all default groups on their first login. This is very useful for scaling, but it can be harmful if configured incorrectly.
A new account is also bound to the login method used to create it, so the user can sign in only with that method afterwards. Find out more in Login method binding.
Find out more details in the Users management article.
SAML user data extraction
If SAML is configured as a login option, missing user data can be filled in automatically based on information from the SAML provider.
If a Dataedo user's email address or name is empty and they authenticate successfully with SAML, their name and email are extracted and filled in automatically.
The name extraction works for Microsoft Entra ID (Azure AD) without any special configuration. However, Okta and Keycloak require some additional work.
Single session mechanism
By default, Dataedo Portal uses a single session mechanism for security reasons. This means that one user can access Dataedo Portal from only one device at a time. When you log in on a new device, all older sessions are closed.
Please note that even if you use Dataedo Portal in two browsers on one device, each browser still uses a separate session — so logging in on one will end your session in the other.
You can disable the single session mechanism in Portal's files. To do so, open the appsettings.json file located in your Portal repository and find the Login key. In the corresponding object, look for the AllowMultipleSessions flag and set it to true.
Cookie settings
The cookie settings control how long you remain logged in after successful authentication. By default, cookies expire 30 days after you log in.
You can, however, customize the login cookie's behavior in the appsettings.json file located in your Portal repository.
The parameters responsible for cookie files are located in the CookieAuthentication key. The three editable parameters are:
ExpireInHourscontrols how long cookies are stored, expressed in hours. It accepts any positive integer and defaults to720SecurePolicycontrols the protocol used to encrypt and transfer your cookie files. It is set toAlwaysby default. Learn more about the accepted values and their outcomes hereSameSitecontrols when cookie files can be sent in cross-site requests. It is set toNoneby default. Learn more about the accepted values and their outcomes here
When you provide an invalid value or delete a parameter, the cookie settings fall back to their default values.
